Zhenyu Pan

Reentrancy vulnerability is one of the most serious security issues in smart contracts, resulting in millions of dollars in economic losses and posing a threat to the trust of the blockchain ecosystem. Therefore, researchers are paying more attention to this problem and have proposed various methods to detect and eliminate potential reentrancy vulnerabilities before contract deployment. Compared to symbolic execution and pattern-matching methods, fuzz testing method can achieve higher accuracy and are better suitable for detecting cross-contract vulnerabilities. However, existing fuzz testing tools often spend a long time exploring states with little pruning, and most of them adopt the reentrancy vulnerability oracle used by static analysis tools, which ignores whether the vulnerability can be exploited to compromise the access control, mutex, or time locks. To address these issues, we propose EvoFuzzer, an evolutionary fuzzer that focuses on the detection of reentrancy vulnerabilities. EvoFuzzer first leverages static analysis to exclude branches that have no impact on state transitions, then continuously optimizes test case generation using a genetic algorithm that considers both function sequence and parameter assignment, and Meanwhile, EvoFuzzer confirms whether reentrancy vulnerabilities can be exploited by simulating attacks. Our experiments have performed on 198 annotated contracts and 47 honeypot contracts, and experimental results show that EvoFuzzer can detect 91.7% of reentrancy vulnerabilities with no false positives, achieve the highest F1 score with 95.7%, which is 5.9% higher than the next best approach (Confuzzius), and we also find that it reduces more than 10% of branches when EvoFuzzer adopts a pruning strategy.

Smart contract security is one of the core issues in any application based on blockchain. There are many techniques focusing on smart contract security, however, due to the diversity of Solidity versions and limitations of detection time, it is difficult for them to comprehensively localize defects in different versions of smart contracts. In this article, we propose a static defect detection method based on the knowledge graph of the Solidity language and present a defect detection tool called SoliDetector . First, we define the ontology layer of the knowledge graph and construct the instance layer in which syntactic and logical relationships are captured. Second, we introduce the defect pattern to describe each defect and design inference rules to infer complex relationships and judge whether a defect exists. Finally, we localize defects by executing SPARQL queries. SoliDetector can support the detection of 20 kinds of defects and the automatic SPARQL query generation. We conducted several experiments on multiple datasets. SoliDetector obtains a high F-score (i.e., 92.97% on Dataset1 and 91.54% on the SmartBug dataset). To compare SoliDetector with SmartCheck , Slither , and Mythril , we conducted experiments on a labeled benchmark Dataset3 and real-world contracts. SoliDetector has a high F-score of 94.04% and is faster than other tools with an average time of 0.37 s for each contract.

As one of the most complex types of vulnerabilities, reentrancy poses a significant threat to smart contract development. Indeed, millions of dollars have evaporated due to reentrancy vulnerabilities of smart contracts in past years. In this article, we propose a new approach to detect reentrancy vulnerabilities using fuzz testing and develop a novel tool named ReDefender. Our approach consists of three main steps: 1) preprocess contract to be detected: when a contract is uploaded, its source code will be preprocessed to extract candidate pool for fuzzing and dependency graph which guides the automatic deployment of contracts; 2) fuzzing input generation: fuzzing input is generated to constitute transactions which will be sent to an agent contract to stimulate attacks, where runtime information is collected and recorded in the execution log during each execution; and 3) vulnerability verification: the execution log is analyzed to determine whether a reentrancy process occurs and whether the reentrancy process is malicious. We conduct comparative experiments on 204 tagged smart contracts and 90 injected contracts. The results show higher accuracy and lower false negative rate of ReDefender than that of the other three famous tools. Moreover, we conduct an experiment on 4776 real-world contracts demonstrating the ability of ReDefender to find reentrancy vulnerabilities that really cause economic losses.